@kubun/plugin-connector 0.14.2 → 0.14.3

package/lib/index.js

@@ -453,32 +453,98 @@ export function createConnectorPlugin(options) {
             }
             return result;
         };
-        // Opt-in: arm periodic sync for the authenticated owner on every
-        // `connector:authenticated`. Subscribed on `lifecycleEvents` (the merged,
-        // tagged channel), not the per-event `events` channel forwarded to
-        // external plugin consumers as `connectorPluginAPI.events` — this
-        // subscriber is the connector plugin's own internal wiring, not a
-        // consumer of its public surface, so it stays decoupled from whatever
-        // external listeners do with `events`. `reactivate: false` so a schedule
-        // the user explicitly disabled is not silently re-armed by a later
-        // re-authentication; an absent schedule is still created enabled. Fire-
-        // and-forget and best-effort: a missing workflow plugin (or any other
-        // failure) is caught here rather than thrown into the emitter's listener,
-        // which would otherwise only be logged and swallowed.
+        // Arm-if-absent recovery for one owner: for every connector this owner holds
+        // a credential for, create a periodic schedule when none exists yet. An
+        // existing schedule — enabled or user-disabled — is left untouched, so this
+        // is safe to run repeatedly and never rewrites a live schedule's `next_run`
+        // or re-announces an already-enabled one. It is the shared body of both the
+        // auth-event subscriber and the boot sweep: arming the just-authenticated
+        // connectors and retrying any earlier arm that failed transiently for the
+        // same owner. Failures are isolated per connector and never propagate.
+        const reconcileOwnerNow = async (ownerDID)=>{
+            const workflowAPI = await getWorkflowAPI();
+            if (workflowAPI == null) return;
+            for (const connector of registry.getAll()){
+                if (connector.auth.provider === 'device') continue;
+                try {
+                    const credential = await backgroundCredentialProvider.get(connector.auth.provider, ownerDID);
+                    if (credential == null) continue;
+                    const { subjectKey } = periodicSyncSubject(connector.name, ownerDID);
+                    const existing = await workflowAPI.getPeriodicSync(`${CONNECTOR_SYNC_WORKFLOW}:${subjectKey}`);
+                    if (existing != null) continue;
+                    await enablePeriodicSyncForOwner(connector.name, ownerDID, undefined, {
+                        reactivate: false
+                    });
+                } catch (err) {
+                    logger.debug('auto-arm reconcile skipped {connector} {ownerDID}', {
+                        connector: connector.name,
+                        ownerDID,
+                        error: err instanceof Error ? err.message : String(err)
+                    });
+                }
+            }
+        };
+        // Serialize reconciles per owner. The arm-if-absent check (getPeriodicSync)
+        // and the arm are two steps, so two reconciles of the same owner running
+        // concurrently — the boot sweep racing an auth event, or two auth events in
+        // quick succession — could both read a subject as absent and both arm it. The
+        // atomic upsert stops that becoming a PK error, but the loser would still
+        // rewrite `next_run` and emit a second `periodicSync:enabled`, breaking the
+        // no-touch guarantee above. Chaining per normalized owner makes the later run
+        // observe the schedule the earlier one created, so it skips.
+        const reconcileChains = new Map();
+        const reconcileOwner = (ownerDID)=>{
+            const key = normalizeDID(ownerDID);
+            const prev = reconcileChains.get(key) ?? Promise.resolve();
+            const next = prev.catch(()=>{}).then(()=>reconcileOwnerNow(ownerDID));
+            reconcileChains.set(key, next);
+            void next.finally(()=>{
+                // Only the tail clears the entry; a newer chained run keeps it alive.
+                if (reconcileChains.get(key) === next) reconcileChains.delete(key);
+            });
+            return next;
+        };
+        // Opt-in: reconcile the authenticated owner on every `connector:authenticated`.
+        // Subscribed on `lifecycleEvents` (the merged, tagged channel), not the
+        // per-event `events` channel forwarded to external plugin consumers as
+        // `connectorPluginAPI.events` — this subscriber is the connector plugin's own
+        // internal wiring, not a consumer of its public surface, so it stays decoupled
+        // from whatever external listeners do with `events`. Reconciling the whole
+        // owner (not just `event.connectors`) means a connector whose arm failed at an
+        // earlier auth is recovered the next time the owner authenticates anything.
+        // Fire-and-forget and best-effort: any failure is caught inside
+        // `reconcileOwner` rather than thrown into the emitter's listener.
         if (options.autoEnablePeriodicSync) {
             manager.lifecycleEvents.on('lifecycle', (event)=>{
                 if (event.type !== 'connector:authenticated') return;
-                for (const connector of event.connectors){
-                    enablePeriodicSyncForOwner(connector, event.ownerDID, undefined, {
-                        reactivate: false
-                    }).catch((err)=>{
-                        logger.debug('auto-enable periodic sync skipped {connector} {ownerDID}', {
-                            connector,
-                            ownerDID: event.ownerDID,
-                            error: err instanceof Error ? err.message : String(err)
-                        });
+                reconcileOwner(event.ownerDID).catch((err)=>{
+                    logger.debug('auto-arm reconcile (on auth) failed {ownerDID}', {
+                        ownerDID: event.ownerDID,
+                        error: err instanceof Error ? err.message : String(err)
                     });
+                });
+            });
+            // Boot sweep (standalone only): on init, re-arm any owner authenticated in a
+            // previous run whose schedule is missing — the restart/mount recovery for a
+            // transient arm failure that no later auth would otherwise reach. It runs
+            // once, off the request path, so it is fire-and-forget and must not block or
+            // fail init. Service mode has no local credential store to enumerate and its
+            // remote backend owns its own reconcile, so the sweep is skipped there; the
+            // auth-event path above still recovers in both modes.
+            void (async ()=>{
+                const serviceProvider = await credentialServiceProviderPromise;
+                if (serviceProvider != null) return;
+                const { api } = getStandaloneStack(params.db);
+                const providers = new Set(registry.getAll().map((connector)=>connector.auth.provider).filter((provider)=>provider !== 'device'));
+                const owners = new Set();
+                for (const provider of providers){
+                    for (const owner of (await api.listSubjects(provider)))owners.add(owner);
                 }
+                for (const owner of owners)await reconcileOwner(owner);
+            })().catch((err)=>{
+                logger.debug('auto-arm boot sweep failed {error}', {
+                    error: err instanceof Error ? err.message : String(err)
+                });
             });
         }
         // Process-local dedup for the no-workflow-plugin fallback path only (the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-connector",
-  "version": "0.14.2",
+  "version": "0.14.3",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -18,7 +18,7 @@
     "@kokuin/jwe": "^0.1.0",
     "@kokuin/token": "^0.5.0",
     "@kubun/connector": "^0.14.0",
-    "@kubun/credential": "^0.14.2",
+    "@kubun/credential": "^0.14.3",
     "@kubun/credential-types": "^0.14.0",
     "@kubun/db": "^0.14.0",
     "@kubun/engine": "^0.14.1",
@@ -31,7 +31,7 @@
     "@kubun/protocol": "^0.14.1",
     "@kubun/service-credential-api": "^0.14.0",
     "@kubun/store-connector": "^0.14.0",
-    "@kubun/store-credential": "^0.14.0",
+    "@kubun/store-credential": "^0.14.1",
     "@kubun/store-delegation": "^0.14.0",
     "@kubun/store-graph": "^0.14.1",
     "@noble/hashes": "^2.4.0",
@@ -50,6 +50,7 @@
     "@kokuin/controller": "^0.1.0",
     "@kubun/blob-backend": "^0.14.0",
     "@kubun/connector-google-mail": "^0.14.0",
+    "@kubun/db-node-sqlite": "^0.14.0",
     "@kubun/db-postgres": "^0.14.0",
     "@kubun/models": "^0.14.0",
     "@kubun/plugin-blob": "^0.14.0",